https://twitter.com/kennwhite/status/568270748638318593
Adware is at best an annoyance and at worst can make your computer vulnerable to hacks and attacks. Normally, this kind of software is downloaded unknowingly and by accident, but Lenovo has taken adware to a scary new place — by shipping PCs with it already installed.
This adware, Superfish, works by taking over security certificates and replacing them with its own, monitoring your traffic and delivering ads based on what you’re doing online. But that’s not the worst part.
The false website security certificates could allow Superfish to decrypt a user’s HTTPS web traffic. It’s unlikely that Superfish is out to get your banking credentials or other logins. The site certificate tampering could, however, open the door for hackers to launch phishing attacks—especially since Superfish appears to be using the same private encryption key on all Lenovo machines.
A hacker could, for example, create a phony banking site relying on the faked Superfish security certificates for authentication. Under this scenario, Lenovo PCs wouldn’t be able to detect they were visiting a forged site.
Basically, anyone who knows how to use that Superfish’s ability to mimic other sites and take your personal info. Lenovo has responded to the concerns, saying, “We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.” But Wired spoke to a security expert who declared this “a bald-face lie.” And he did it in the time it takes to watch a Christopher Nolan movie.
According to Graham, it took him about three hours to crack Superfish’s security and determine the password he’d need to make such an attack. It’s “komodia,” which happens to be the Greek goddess of happiness and amusement, and the name of a company that writes software that intercepts secure web traffic.
Lesson to Lenovo: try a password with both capital and lowercase letters, maybe some special characters and numbers.